Data protection for barristers: a practical UK GDPR guide

Barristers handle some of the most sensitive personal information there is: medical records, criminal histories, details of children, financial disclosure and private correspondence. Data protection is therefore not a box ticking exercise for the Bar. It goes to the heart of client confidentiality and professional trust. Yet many self-employed barristers are unsure exactly what the law requires of them individually, particularly when chambers handles much of the administration.

This guide explains the essentials of data protection for barristers in England and Wales under the UK GDPR and the Data Protection Act 2018.

You are a data controller

Each self-employed barrister is generally a data controller in their own right for the personal data they process in their practice. That means you are personally responsible for complying with data protection law, even if your chambers provides systems, staff and policies. Chambers itself will usually be a controller for some purposes, such as its own marketing and staff records, and may act as a processor for others, but it does not take over your responsibility.

Pay the ICO data protection fee

Most organisations and sole traders that process personal data must pay an annual data protection fee to the Information Commissioner's Office unless an exemption applies. Self-employed barristers are generally required to pay it. The fee is modest, but failing to pay can lead to a penalty. Check that you are registered, that your details are current, and that the renewal is in your diary.

Know your lawful bases

Every processing activity needs a lawful basis. For barristers, the most common are:

• Contract, where processing is necessary to perform a contract with the client, particularly in direct access work.
• Legal obligation, for example anti-money laundering checks or tax records.
• Legitimate interests, which often covers processing in the course of advising and representing clients when instructed by a solicitor.

Much of what barristers handle is special category data, such as health, sex life or ethnic origin, or criminal offence data. Processing these requires an additional condition. The condition relating to the establishment, exercise or defence of legal claims is the one most often relied on at the Bar. Record which bases and conditions you rely on.

Have a privacy notice

You must tell people how you use their personal data. A privacy notice should explain who you are, what data you collect, why, the lawful basis, who you share it with, how long you keep it and what rights people have. Many chambers provide a template for members, but you should make sure it reflects your own practice, including any direct access work, and that it is available on your profile or sent with client care letters.

Keep records of processing

Controllers are generally required to keep records of their processing activities. For a barrister this can be a straightforward document listing the categories of data you hold, the purposes, the people you share it with, retention periods and the security measures you use. It is also an invaluable tool if the ICO ever asks how you handle data.

Security: the practical heart of compliance

Most data protection problems at the Bar are about security. The law requires appropriate technical and organisational measures. In practice that usually means:

• full disk encryption on laptops, tablets and phones;
• strong, unique passwords and multi-factor authentication on email and cloud accounts;
• keeping software and operating systems updated;
• using secure, reputable cloud services, and checking where data is stored;
• not using personal email accounts or messaging apps for client material unless you are confident they are secure and appropriate;
• locking screens and keeping paper papers secure, particularly when travelling;
• secure disposal of paper documents, for example by cross cut shredding or a confidential waste service.

Retention: do not keep data for ever

Personal data should be kept only as long as necessary. Set a retention policy that reflects limitation periods, insurance requirements and any regulatory expectations, and apply it. Many barristers return or destroy papers at the conclusion of a case and keep a limited file for a fixed number of years. Holding old data indefinitely increases your risk without any benefit.

Individual rights

Clients, opponents and witnesses all have rights under the UK GDPR, including the right of access. A subject access request must usually be answered within one month. Legal professional privilege and other exemptions may apply to some material, but you still need to respond properly. Have a simple process for recognising and handling requests, and speak to your chambers' data protection lead if one arrives.

Sharing data with others

Barristers share information routinely with solicitors, clerks, experts and courts. Make sure each disclosure is necessary for the case. If you use outsourced services, such as a clerking provider, transcription service or practice management software, check that a proper agreement is in place and that the provider has adequate security.

Insurance and professional obligations

The Bar Mutual Indemnity Fund and the Bar Standards Board both expect barristers to take information security seriously. Confidentiality is a core duty under the BSB Handbook, quite apart from data protection law. A breach can lead to complaints, regulatory investigation and, in serious cases, claims.

Make it a habit

Data protection compliance is not difficult for most barristers once the basics are in place: pay the fee, keep a privacy notice and records, secure your devices and apply a retention policy. Review them once a year, perhaps when you renew your practising certificate.

When Clerk&Counsel introduces work to barristers on our panel, we only share the information needed to consider and accept an instruction, and our own privacy policy explains how we handle personal data.

This article is general information, not legal advice. For guidance specific to your practice, consult the ICO's website, your chambers' data protection lead or the Bar Council's ethics and practice resources.